HACKED!

It would appear a site we worked on has been hacked. If you view the source of www.goodwinsmusic.ie you will see the following line of code at the bottom of every page on the site:

<adsttnmq1><font style="position: absolute;overflow: hidden;height: 0;width: 0">testsfksdlkshd2445</font></body></html><sdioyslkjs2>

Having googled the above it would seem that the problem may be related to the software my host has running, however I just thought i’d point it out in case there is a larger security issue at play here.

Still have no figured out how to fix it yet. I removed a weird folder from the root of my site but the problem remains.
Anyone see this before with MODx?

Well, those lines are being inserted from somewhere. Are they added to the index.php files? Have you cleared the cache?

Hey, found out more info about this attack: http://www.esuli.it/2009/03/24/adsttnmq1sdioyslkjs2-attack/
What happens is they get in via an exposed ftp account (or so people think)
The copy up a folder/scripts which scan for an index.php index.html file and insert the line:
<adsttnmq1><font style="position: absolute;overflow: hidden;height: 0;width: 0">testsfksdlkshd2445</font></body></html><sdioyslkjs2>
at the bottom.

This line was therefore coming out sidewide for me. I have since removed the malcious folder, and removed the line from my index.php file.
I also noticed the permissions had been set to 777, which is not good on index.php. I changed these back.

Anyone sen this one before?

Might want to take a look at your manager/index.php file as well.

I suspected it was there, since the line was being added after the normal end of page </body></html> tags.

Make sure to change your FTP passwords.

Yes to confirm it was an ftp exploit.
luckily they did not do too much damage...